Type of Requisition:
Regular
Clearance Level Must Currently Possess:
Top Secret SCI + Polygraph
Clearance Level Must Be Able to Obtain:
Top Secret SCI + Polygraph
Public Trust/Other Required:
None
Job Family:
Cyber and IT Risk Management
Job Qualifications:
Skills:
Cyber Risks, Cybersecurity Controls, Cybersecurity Risk Management, Security Controls, Security Risk Certifications:
None Experience:
5 + years of related experience US Citizenship Required:
Yes
Job Description:
Your Impact
Own your opportunity as an IT & Cyber Risk Auditor Principal at GDIT. You’ll lead enterprise-level IT and cybersecurity risk and compliance assessments that help secure the systems and data vital to our national security missions. At GDIT, the mission is our purpose, and our people are at the center of everything we do.
As a trusted audit leader, you’ll evaluate cyber and IT controls, identify risk exposure, and influence remediation strategies while partnering with cross-functional teams to strengthen enterprise risk posture. Your work will have meaningful impact across federal government and defense programs.
What You’ll Do
Lead and execute rigorous IT and cybersecurity risk audits and assessments
Evaluate IT general controls, cybersecurity controls, and risk management processes
Assess compliance with federal frameworks and guidance (e.g., NIST, RMF, FISMA, FedRAMP, ISO 27001)
Identify and document control gaps, risk exposures, and areas for process improvement
Provide risk-based recommendations and actionable insights to senior leadership and stakeholders
Support preparation of audit reports and executive briefings
Manage and execute system Certification and Accreditation processes, ensuring compliance with security controls and requirements outlined in agency policies.
Collaborate with cybersecurity, IT, compliance, and program teams to drive remediation and sustainable improvements
Participate in internal and external audit activities, including customer assessments
Experience using XACTA data base applications and the ICD 503, NIST 800-83 rev4 policy
Review monthly vulnerability scan reports and track and address weaknesses in plans as needed.
Perform security system event analysis, investigation, and validation
Provide incident response to classification spills, malware infection, misconfiguration exposure, internal inappropriate behavior and technical issue
Perform Security Technical Implementation Guide (STIG) and Federal Information Security Management Act (FISMA) assessments and annual reporting
Work and completing multiple Authority to Operate (ATO) security packages simultaneously
What You’ll Need to Succeed
5+ years of progressive experience to an intermediate level in IT audits, cybersecurity risk management, or information assurance
Experience using XACTA data base applications and the ICD 503, NIST 800-83 rev4 policy
Experience with Splunk, Security Center, Telos XACTA, and MacAfee EPO
Expertise with cybersecurity and IT control frameworks and compliance requirements
Experience conducting complex IT and cybersecurity audits in government or federal contracting environments
Experience with cloud security risk assessments and modern technologies
Clear and effective communication skills with the ability to influence technical and executive audiences
Ability to multi-task, prioritize, and re-prioritize work in a fast-paced environment
Ability to learn an application environment in order to update or create supported security documentation
Qualifications
Bachelor’s degree or equivalent military training in Information Systems, Cybersecurity, Computer Science, Accounting, or related field
Maintain certification in accordance with DoW Directive 8140.01 Cyberspace Workforce Management requirements
Applicable certifications include: SecurityX / CASP+, CGRC/CAP, GSEC, GSNA, Security+, SSCP, CISSP, CISM
Currently hold certification in good standing to satisfy IAM Level II (Information Assurance Management Level 2) per DoW 8570/8140
Hold a…